n8n CVE-2025-68613

Requires an authenticated n8n user who can create or edit workflows and supply expressions in the workflow expression-evaluation system; the attacker crafts an expression that escapes the sandbox (the patch specifically neutralizes regular functions binding their this to the Node.js global and blocks access to process.mainModule/binding/_load). Limiting factors: exploitation is gated by authentication and workflow-edit permission (PR:L), so risk is highest where untrusted or low-trust users have workflow access or where credentials can be obtained; affected versions are >=0.211.0 and below 1.120.4, 1.121.1, or 1.122.0. No special non-default product configuration is required beyond a user having expression/workflow authoring capability. Vendor mitigations (restricting workflow authoring to trusted users, hardened OS privileges/network) reduce but do not eliminate risk.

Signals are strongly aligned toward high real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack requiring only low privileges (any authenticated user with workflow edit rights) and no user interaction, yielding full confidentiality, integrity, and availability loss - consistent with the CWE-913 (improper control of dynamically-managed code) sandbox-escape described. POC is publicly available and a vendor patch exists, raising both exploitability and the pool of actors who can reverse the fix. Notably, one NVD reference is an Akamai research article describing the 'Zerobot' malware actively targeting the n8n automation platform, which implies real exploitation activity beyond mere POC; however, the input does NOT explicitly set KEV=YES - the CISA KEV reference is only a catalog search URL, not a confirmed listing - so active exploitation cannot be treated as CISA-confirmed. Treat this as 'publicly available exploit code exists' with credible but unconfirmed-via-KEV reporting of in-the-wild activity. The only material tempering factor is the PR:L authentication requirement: this is not a pre-auth internet drive-by, so exposure is concentrated in instances where untrusted or lower-trust users can create/edit workflows, or where credentials can be obtained. Given n8n's growing deployment and frequent internet exposure, this is a genuine priority to patch, not a high-CVSS-but-low-risk paper finding.

An attacker who holds (or phishes/obtains) an authenticated n8n account with workflow edit permissions creates or edits a workflow containing a crafted expression (e.g. an IIFE whose function this resolves to the Node.js global, reaching process.mainModule and module loading). When the expression is evaluated, it escapes the insufficiently isolated sandbox and runs arbitrary code with the privileges of the n8n process, compromising the host. Public exploit code exists and security research reports malware (Zerobot) targeting n8n, so weaponization effort is low.